CVE-2025-4920 | Vulnetix

CVE-2025-4920 PUBLISHED

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4 and Firefox ESR < 128.10.1.

EPSS 0.02% · 2.5th percentile

Risk Scores

EPSS Score

0.02%

2.5th percentile

Timeline

May 17, 2025 PoC Published
May 18, 2025 EPSS Score
May 18, 2025 PoC Published
May 18, 2025 PoC Published
May 18, 2025 CVE Rejected
May 18, 2025 CVE Updated
Apr 2, 2026 Security Advisory

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4920 advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1966612 url
https://www.mozilla.org/security/advisories/mfsa2025-36 url
https://www.mozilla.org/security/advisories/mfsa2025-37 url

Open in Interactive Console →